What is a CNAME record? DNS Alias Records Explained

What is a CNAME record?

A CNAME (Canonical Name) record is a DNS record that makes one hostname an alias for another. Instead of holding an address of its own, the alias points at a canonical name, and the resolver follows the pointer to whatever records that name holds — its A record, MX record, and so on. It is the DNS equivalent of a mail-forwarding order: query the alias, and you are redirected to the real destination.

CNAMEs exist to save you from maintaining the same address in several places. Point mail.yourdomain.com at your provider's hostname once, and if that provider changes the underlying IP address, your alias follows automatically — you never touch your own zone.

How does a CNAME record work?

A CNAME record stores an alias and its target. When a resolver looks up the alias, it does not get a final answer; it gets the canonical name and repeats the lookup against that.

For example, a CNAME mapping mail.yourdomain.com to ghs.googlehosted.com sends anything addressed to mail.yourdomain.com on to Google's servers, which supply the actual IP address. The chain can be more than one hop deep — an alias can point to another alias — but every extra hop adds a lookup and a point of failure, so keep chains short.

This is why CNAMEs are everywhere in email setup. Providers like Google Workspace and many marketing platforms ask you to publish CNAME records so their DKIM keys and tracking hostnames resolve through your domain while they manage the underlying values. You publish the alias once; they rotate the target behind it.

The rules that trip people up

CNAMEs behave differently from most records, and three constraints cause nearly every misconfiguration:

• A CNAME cannot share a name with any other record. RFC 1912 states that a name with a CNAME record may have no other data. If mail.yourdomain.com has a CNAME, it cannot also carry an MX or TXT record — the alias replaces them all. Trying to add a sibling record is the most common CNAME error.
• No CNAME at the zone apex. The root of your domain (yourdomain.com with no host in front) must hold SOA and NS records, and the no-siblings rule means it cannot also be a CNAME. Use an A record — or a provider's "ALIAS"/"ANAME"/"CNAME flattening" feature, which returns an address at the apex while behaving like an alias.
• An MX target must not be a CNAME. RFC 5321 requires a mail server hostname to resolve to an address record directly. Pointing an MX at a CNAME is undefined behaviour that some receivers reject.

CNAME vs. other DNS records

It helps to place the CNAME next to its neighbours:

• An A record maps a name straight to an IPv4 address; a CNAME maps a name to another name.
• A TXT record holds free-form text such as SPF or DKIM values; a CNAME holds a single canonical hostname.
• An MX record routes mail and must point at a real hostname, never an alias.

CNAMEs also underpin authentication and branding: some SPF, DKIM, and BIMI delegations are published as CNAMEs so a provider can maintain the record for you, and the authentication result still surfaces in the message's email header.

Why CNAME records matter

• One place to update. Change the canonical name's address and every alias follows, instead of editing each record by hand.
• Cleaner provider onboarding. Third-party mail and marketing services hand you CNAMEs so they can rotate keys and endpoints without asking you to touch DNS again.
• Fewer stale records. Aliasing to a vendor-managed hostname means you are never left publishing an IP address the vendor has already retired.

Check what a name currently resolves to — and whether a CNAME is pointing where you expect — with the DNS lookup tool, and confirm your signing hostnames with the DKIM lookup.

Frequently asked questions

How long does a CNAME change take to take effect?

There is no fixed 48-hour rule. Propagation is governed by the record's TTL: resolvers that cached the old value keep serving it until their copy expires, which with a short TTL is only minutes. Lower the TTL a day before a planned change, then raise it again once the new value is live.

Why can't I add a CNAME on my root domain?

Because the apex already carries the mandatory SOA and NS records, and a CNAME is not allowed to coexist with other records at the same name. Use an A record at the apex, or your DNS provider's flattening feature (ALIAS/ANAME) if you need alias-like behaviour there.

Can a CNAME point to another CNAME?

Yes, chains are legal, but each hop is another lookup and another dependency. Keep chains to a single hop where you can; long chains slow resolution and multiply the ways a change can break.

Does a CNAME affect email authentication?

Only indirectly. Many providers publish DKIM and other authentication data as CNAMEs so they can manage the values for you. The alias itself is neutral — but if it points at the wrong target, the authentication lookup fails, so verify it resolves correctly.

What's the difference between a CNAME and a URL redirect?

A CNAME operates in DNS and redirects name resolution for every protocol at that hostname. A URL redirect happens at the web-server or HTTP layer and only affects browser traffic. They solve different problems and are not interchangeable.

Related reading

• What is a DNS?
• What is an MX record?
• What is a TXT record?